Troubleshooting

Verifying Flow Collection

Capture Packets from the SensorOccasionally, Cisco Support may need to verify the flow data being received by the sensor. Cisco recommends that you do this by generating a packet capture of the flows. You can also open the packet capture in Wireshark to review the data.View the videos, or follow the procedures, for more information.

SSH log into the sensor.

At the prompt, enter sudo tcpdump -D and press Enter to view a list of interfaces. Note the name of your sensor's Control interface.

At the prompt, enter sudo tcpdump -i <control_interface> -n -c 100 "port <port_number>" -w <pcap_name>, replace <control_interface> with your Control interface name, <port_number> with the port number corresponding to your configured flow data, and <pcap_name> with a name for the generated pcap file, then press Enter. The system generates a pcap file with the specified name for that interface's traffic, over the specified port.

Log out of your sensor.

Using an SFTP program, such as PuTTY SFTP (PSFTP), or WinSCP, log into the sensor.

At the prompt, enter get <pcap_name>, replace <pcap_name> with your generated pcap file name, and press Enter to transfer the file to your local workstation.

Capture Packets from the Sensor

Analyze the pcap in Wireshark

Download and install Wireshark, then open Wireshark.

Select File -> Open, then select your pcap file.

Select Analyze -> Decode As.

Click + to add a new rule.

Select CFLOW from the Current drop-down, then click OK. The UI updates to display only packets that are related to NetFlow, IPFIX, or sFlow. If no results appear, the pcap does not contain NetFlow-related packets, and flow data collection is incorrectly configured on the sensor.

Analyze the pcap in Wireshark